How to modify/add a new objectClass to an entry in OpenLDAP

Question

I recently setup centralized authentication system using OpenLDAP. Now I need to extend the users that are defined in the database to include a new object class that contains some security related data about them. How can I modify the existing entries to add this new object class? I'm pretty new to LDAP so don't bite my head off if I managed to ask a stupid question :P Thanks!

Answer 1

You can run ldapmodify to modify one or more entries, you just need to feed to the program the credentials and a file containing all the changes you want to do

As an example (taken straight from openldap manual), if your file contains this it'll add/modify all those fields

dn: uid=john.doe,ou=People,dc=example,dc=com
changetype: add
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: john.doe
givenName: John
sn: Doe
cn: John Doe
mail: john.doe@example.com
userPassword: password

Answer 2

OpenLdap Schema and ObjectClass are easy to extend. Look inside bundled schema if there is the object of your needs (located, on a debian filesystem is /etc/ldap/schema)

After you can modify your ldap entities and attached to them new objectClass (and, by extension, new attribute types).

If you want to build your own attribute type and/or your own objectClass you need to request an OID object number (OID Registration).

Then follow this schema :

objectIdentifier YOUR_OID <IANA NUMBER>
objectIdentifier YOUR_OBJECTCLASS YOUR_OID:1
objectIdentifier YOUR_ATTRIBUTETYPE YOUR_OID:2

Then define your attribute type:

attributetype( YOUR_ATTRIBUTETYPE:1 NAME "your attribute name"
    DESC "quick description"
    EQUALITY typoofequality
    SYNTAX valid syntax

And your object class:

objectclass(YOUR_OBJECTCLASSS:1 NAME "your objectclass name"
    DESC "quick description"
    SUP top #or another objectclass inheritence
    MUST (list of must attributes, separated by "$")
    MAY (list of may attributes, separated by "$") )

The number following the YOUR_ATTRIBUTETYPE/YOUR_OBJECTCLASS must be unique (ie : one number for each attribute)

For reference, have a look at Open LDAP Schema Specification